// Shipped by imprion-pos-base (Doc 3 §7, README decision 290). Updates are
// downloaded any time and never installed here: the boot install
// (imprion-boot-update.service) and the agent's maintenance-window install are
// the only two places anything is installed.
//
// READ 99imprion-apt BEFORE CHANGING ANYTHING HERE. This file is Doc 3 §7
// verbatim, and on a real terminal it is NOT the last word: apt reads
// /etc/apt/apt.conf.d/* in sorted order and `50imprion-unattended` sorts before
// Debian's own `50unattended-upgrades` (i < u). Two consequences, both measured
// in a debian:trixie container:
//
//   * Origins-Pattern is an apt LIST, and a second declaration APPENDS to it.
//     Debian's stock file adds three more entries after these two, one of which
//     is `origin=Debian,codename=${distro_codename},label=Debian` — the whole
//     trixie archive, not just security. The resulting list has five entries.
//   * APT::Periodic::Unattended-Upgrade is set to 1 by Debian's 20auto-upgrades,
//     and at anything but 0 the apt timer runs `unattended-upgrade`, which
//     installs. unattended-upgrades has no `Download-Only` configuration key
//     (only a `--download-only` flag), so the interval is the switch.
//
// So the settings that must WIN live in 99imprion-apt, which sorts last. This
// file stays because Doc 3 §7 names it and because it is the readable statement
// of intent; 99imprion-apt is the enforcement.
Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian";
    "origin=Debian,codename=${distro_codename}-updates,label=Debian";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
    "origin=Imprion,label=Imprion PoS";
};
Unattended-Upgrade::Automatic-Reboot "false";
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "0";
